- - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200308-02
- - ---------------------------------------------------------------------

          PACKAGE : semi
          SUMMARY : insecure temporary files creation
             DATE : 2003-08-14 19:30 UTC
          EXPLOIT : local
VERSIONS AFFECTED : =semi-1.14.5-r1
              CVE : CAN-2003-0440

- - ---------------------------------------------------------------------

quote from CVE:

"The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and
possibly other versions, allows local users to overwrite arbitrary files
via a symlink attack on temporary files."

SOLUTION

It is recommended that all Gentoo Linux users who are running
app-emacs/semi upgrade to semi-1.14.5-r1 as follows

emerge sync
emerge semi
emerge clean

- - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at   
usata@gentoo.org